Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions #32662

Closed
marwan-at-work opened this issue Jun 17, 2019 · 4 comments
Closed

cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions #32662

marwan-at-work opened this issue Jun 17, 2019 · 4 comments
Labels
FrozenDueToAge modules NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@marwan-at-work
Copy link
Contributor

marwan-at-work commented Jun 17, 2019 •
edited

Go version: Go 1.12.6

The following command fails:

GOPROXY=https://proxy.golang.org GOPATH=/tempdir go install github.com/golangci/golangci-lint/cmd/golangci-lint

The failure error comes out to be:

build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

It turns out that golangci-lint's go.mod file has an incorrect timestamps in the pseudo-semver version: v0.0.0-20181204210945-1df300866540 because they updated the go.mod file manually which seems to be here (golangci/golangci-lint@7274db7#diff-37aff102a57d3d7b797f152915a6dc16R8)

If you run:

curl https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info

You get

{"Version":"v0.0.0-20190526074819-1df300866540","Time":"2019-05-26T00:48:19-07:00"}

Notice that the timestamp here is 20190526074819 while the golangci's go.mod file is 20181204210945. See here: https://github.com/golangci/golangci-lint/blob/master/go.mod#L8

Since the .info endpoint succeeds and returns a different version, I'm surprised that the Go command did not pick up the new version for the following .zip call. Is this the expected behavior?

Interestingly enough, go mod download doesn't care about the timestamp, and since it's the recommended tool to use, GOPROXY=off and GOPROXY=<athens> succeed but proxy.golang.org fails.

cc: @fsouza
@heschi heschi self-assigned this Jun 17, 2019
@heschi
Copy link
Contributor

heschi commented Jun 17, 2019

Thanks for the excellent report. This looks like a bug in the go command to me:

$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
go: finding github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.info
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20190526074819-1df300866540.mod
go: downloading github.com/go-critic/go-critic v0.0.0-20181204210945-1df300866540
Fetching https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip
build github.com/golangci/golangci-lint/cmd/golangci-lint: cannot load github.com/go-critic/go-critic/checkers: unexpected status (https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.zip): 400 Bad Request

Note that it uses the canonicalized pseudoversion to download the .mod, but not the .zip. I'd like to hear an opinion from @bcmills @jayconrod on what's going on here. I think we may have to support these kinds of requests in proxy.golang.org though.

@dmitshur dmitshur added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 17, 2019
@dmitshur dmitshur added this to the Unreleased milestone Jun 17, 2019
@bcmills
Copy link
Contributor

bcmills commented Jun 17, 2019

This is closely related to #27173. I'm still investigating how frequent these are in practice.

With the current draft of CL 181881, I get a more consistent failure using the proxy:

example.com$ go mod init example.com
go: creating new go.mod: module example.com

example.com$ GOPROXY=https://proxy.golang.org GOPATH=$(mktemp -d) go build -x -v github.com/golangci/golangci-lint/cmd/golangci-lint |& grep go-critic
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod
# get https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request (0.119s)
        github.com/go-critic/go-critic@v0.0.0-20181204210945-1df300866540: reading https://proxy.golang.org/github.com/go-critic/go-critic/@v/v0.0.0-20181204210945-1df300866540.mod: 400 Bad Request

@bcmills
Copy link
Contributor

bcmills commented Jun 17, 2019

Note specifically the fixes to (*modfetch.codeRepo).GoMod and (*modfetch.codeRepo).Zip in that CL.

@bcmills bcmills changed the title proxy.golang.org: inconsistent behavior on incorrect timestamps cmd/go: 'go.mod' file loading fails to detect invalid pseudo-versions Jun 17, 2019
@gopherbot
Copy link

Change https://golang.org/cl/181881 mentions this issue: cmd/go: validate pseudo-versions against module paths and revision metadata

@bcmills bcmills assigned bcmills and unassigned heschi Jun 18, 2019
@heschi heschi mentioned this issue Jun 25, 2019
Closed
@golang golang locked and limited conversation to collaborators Jun 20, 2020
@rsc rsc unassigned bcmills Jun 23, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge modules NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
5 participants
@dmitshur @bcmills @gopherbot @marwan-at-work @heschi